2 ms·

I use P521 for all my server host keys. Do these need to be rotated after my users upgrade their PuTTY clients?

• strbean 3y ago
  > (The problem is not with how the key was originally generated; it doesn't matter whether it came from PuTTYgen or somewhere else. What matters is whether it was ever used with PuTTY or Pageant.) Sounds like your server keys are safe.
  • cchance 3y ago
    I mean it also sounds like you'd need to be using a exploited server, or give the hacker access to your pageant...
• germinator 3y ago
  This exposed client keys, not server keys. The client keys are at risk only in a handful of specific scenarios - e.g., if used to connect to rogue or compromised servers, or used for signing outside SSH. This is not exploitable by simply passively watching traffic, so even for client keys, if you're certain that they were used in a constrained way, you should be fine. The difficulty is knowing that for sure, so it's still prudent to rotate.
• Skrillor 3y ago
  No, only NIST P-521 client keys used with PuTTY are affected. The server host key signature is computed by the server (most likely OpenSSH) which is unaffected.
• deleted 3y ago
  [deleted]